I am trying to provide DBAdmin privilege for a user on multiple databases.
I know how to do from on premises SQL database, I can directly map the user to required databases.
Can anyone let me know how to do it in Azure managed instance. Since the added user is external user, can,t see it in the Logins to map the user.
I have like 100 databases on which the user should have db admin right. Is there a easiest way to do that?
You can use an Azure Active Directory Login
eg
CREATE LOGIN [someuser#somecompany.onmicrosoft.com] FROM EXTERNAL PROVIDER
then create users mapped to this login in the appropriate databases, or make this login a sysadmin. Not sure if this shows up in SSMS, as it was added relatively recently. So you may have to create the users and grant them permissions in the target databases in TSQL, as per: https://learn.microsoft.com/en-us/azure/sql-database/sql-database-managed-instance-aad-security-tutorial
I'm using CouchDB 2.1.0 and for my use case I would like non-admin users to be able to create their own databases that they will then have write/read access to, and the ability to add other users with write/read access.
Note that this is not one database per user, which seems to be the common use case, but many user-created databases per user.
Users are being created right now by POSTing to the _users database. Authentication is being handled by CouchDB's built-in authentication.
I could create a backend service that has admin credentials that would create these databases, but I would like to avoid doing so. Reading through docs it seems like by default CouchDB only allows admins to create databases; is there a way to change this?
Honestly, I think the only real answer here is that you'll have to make a backend service that has admin credentials that can create new databases. Kind of a bummer since one of my goals for this project was "no backend other than CouchDB".
My backend service ended up just taking a list of users that should have access to the created database, creating the database with a unique ID, and returning that ID. I then have a document in each user's DB that lists all of the DBs they have created.
We have an application where user login is implemented using JavaEE5 Servlets, Filters, Spring3.0 and SQL Server database tables. When a user logs into the application, a record on User database table is added against the user. If any other user logs in whist the first user already logged in with same login credentials, we either avoid it or allow it depending on some conditions. This is made easy because of having single database table recording all user logins. I'm wondering if there is any way to avoid database and rely on application server. We are using JBoss5.1 currently.
Scenario..
1 database role - 5 developers needs to be mapped with same access.
All 5 developers must login to sql server using there own username and password.
I want all these 5 developers must be mapped to 1 unique database role. So that if I changes permissions of this roles. All the developers are promoted to same permissions.
How to do this.
Currently when I creates a login using wizard It asks me for creating database user along with it. Which I don't want bcoz I want all logins to be mapped to single role.
Never create database logins for individual users.
First step is to create an NT group:
Net Localgroup MyDatabaseLoginGroup /Add
Net LocalGroup MyDatabaseLoginGroup /Add UserName1
Alternatively you could use a Domain login for this.
Second step is to create a Server and Database login for the group DOMAIN\MyDatabaseLoginGroup. Call it MydatabaseLoginGroup.
Third step is to create a database Role, DatabaseRoleName and make the group a member of it.
You should manage all internal permissions via database roles. You can make the Database logins map to as many roles as you like. Ideally each role would encompass a reasonable set of required functionality which can be granted as a block.
I have recently been running into many different areas of SQL Server that I normally don't mess with. One of them that has me confused is the area of Logins and Users. Seems like it should be a pretty simple topic...
It appears that each login can only have 1 user and each user can only have 1 login.
A login can be associated to multiple tables thus associating that user to many tables.
So my question is why even have a login and a user? they seem to be pretty much one in the same. What are the differences, or what is it that I seem to be missing?
A "Login" grants the principal entry into the SERVER.
A "User" grants a login entry into a single DATABASE.
One "Login" can be associated with many users (one per database).
Each of the above objects can have permissions granted to it at its own level. See the following articles for an explanation of each
Principals
Database Users
One reason to have both is so that authentication can be done by the database server, but authorization can be scoped to the database. That way, if you move your database to another server, you can always remap the user-login relationship on the database server, but your database doesn't have to change.
I think there is a really good MSDN blog post about this topic by Laurentiu Cristofor:
The first important thing that needs to be understood about SQL Server
security is that there are two security realms involved - the server
and the database. The server realm encompasses multiple database
realms. All work is done in the context of some database, but to get
to do the work, one needs to first have access to the server and then
to have access to the database.
Access to the server is granted via logins. There are two main
categories of logins: SQL Server authenticated logins and Windows
authenticated logins. I will usually refer to these using the shorter
names of SQL logins and Windows logins. Windows authenticated logins
can either be logins mapped to Windows users or logins mapped to
Windows groups. So, to be able to connect to the server, one must have
access via one of these types or logins - logins provide access to the
server realm.
But logins are not enough, because work is usually done in a database
and databases are separate realms. Access to databases is granted via
users.
Users are mapped to logins and the mapping is expressed by the SID
property of logins and users. A login maps to a user in a database if
their SID values are identical. Depending on the type of login, we can
therefore have a categorization of users that mimics the above
categorization for logins; so, we have SQL users and Windows users and
the latter category consists of users mapped to Windows user logins
and of users mapped to Windows group logins.
Let's take a step back for a quick overview: a login provides access
to the server and to further get access to a database, a user mapped
to the login must exist in the database.
that's the link to the full post.
In Short,
Logins will have the access of the server.
and
Users will have the access of the database.
I think this is a very useful question with good answer. Just to add my two cents from the MSDN Create a Login page:
A login is a security principal, or an entity that can be authenticated by a secure system. Users need a login to connect to SQL Server. You can create a login based on a Windows principal (such as a domain user or a Windows domain group) or you can create a login that is not based on a Windows principal (such as an SQL Server login).
Note:
To use SQL Server Authentication, the Database Engine must use mixed mode authentication. For more information, see Choose an Authentication Mode.
As a security principal, permissions can be granted to logins. The scope of a login is the whole Database Engine. To connect to a specific database on the instance of SQL Server, a login must be mapped to a database user. Permissions inside the database are granted and denied to the database user, not the login. Permissions that have the scope of the whole instance of SQL Server (for example, the CREATE ENDPOINT permission) can be granted to a login.
Graph on logins / users from MS sql-docs